How secure is your Recruitment website? Part 4 - SQL Injection

Posted By: Thomas Shaw, 11:17am Wednesday 19 August 2009

Database security is a huge issue at the moment - imaging having your whole database stolen and distributed to your competitors or being used for identity theft? SQL Injection attacks present a serious threat to the security of a recruitment website and it is essential that adequate countermeasures are taken to prevent such an attack from being successful.

SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed.

Itís somewhat shameful that there are so many successful SQL Injection attacks occurring, because it is EXTREMELY simple to avoid vulnerabilities in your code.

One of the most effective methods of preventing SQL injection from being used is to thoroughly validate EVERY SINGLE input from the user, by identifying all possible meta-characters which could be utilised by the database system and filtering them out.

Be proactive in computer security. A combination of security measures such as; validation, neutralizing meta-characters, restricting error messages and limiting access rights to the web server can be used to comprehensively protect your website.†